ELK筆記00：安裝

安裝ES叢集

下載下傳：

wget https://mirrors.huaweicloud.com/elasticsearch/7.3.1/elasticsearch-7.3.1-linux-x86_64.tar.gz
tar -zvxf elasticsearch-7.3.1-linux-x86_64.tar.gz
           

環境變量：

vi /etc/profile
export ES_HOME=/usr/elasticsearch-7.3.1
export PATH=$PATH:$ES_HOME/bin
source /etc/profile
           

建立elsearch賬戶：

# 添加使用者并修改所有權
groupadd elsearch
useradd elsearch -g elsearch
chown -R elsearch:elsearch ${ES_HOME}

# 建立資料目錄和日志目錄
mkdir -p /var/data/elasticsearch
chown -R elsearch:elsearch /var/data/elasticsearch
mkdir -p /var/log/elasticsearch
chown -R elsearch:elsearch /var/log/elasticsearch
           

系統參數修改：解決max file descriptors和max virtual memory areas

vim /etc/sysctl.conf
vm.max_map_count=262144
sysctl -p

# 修改limits：
vim /etc/security/limits.conf
elsearch  hard    nofile  65536
elsearch  soft    nofile  65536

#登入elsearch賬戶,檢視是否生效
su elsearch
ulimit -Hn
           

修改配置檔案：

主機1：10.90.15.45

vi ${ES_HOME}/config/elasticsearch.yml
cluster.name: es-cluster-test
node.name: node-1
node.master: true
node.data: true
#注意一定要是路徑後面加上/var/data/elasticsearch/nodes，要不然無法加入叢集
path.data: /var/data/elasticsearch/nodes
path.logs: /var/log/elasticsearch
network.host: 10.90.15.45
http.port: 9200
transport.tcp.port: 9300
http.cors.enabled: true
http.cors.allow-origin: "*"
xpack.security.enabled: false
# 注意：位址的話可以配置内網IP位址
discovery.seed_hosts: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
cluster.initial_master_nodes: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
           

主機2：10.90.15.43

vi ${ES_HOME}/config/elasticsearch.yml
cluster.name: es-cluster-test
node.name: node-2
node.master: true
node.data: true
#注意一定要是路徑後面加上/var/data/elasticsearch/nodes，要不然無法加入叢集
path.data: /var/data/elasticsearch/nodes
path.logs: /var/log/elasticsearch
network.host: 10.90.15.43
http.port: 9200
transport.tcp.port: 9300
http.cors.enabled: true
http.cors.allow-origin: "*"
xpack.security.enabled: false
# 注意：位址的話可以配置内網IP位址
discovery.seed_hosts: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
cluster.initial_master_nodes: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
           

主機3：10.90.15.44

vi ${ES_HOME}/config/elasticsearch.yml
cluster.name: es-cluster-test
node.name: node-3
node.master: true
node.data: true
#注意一定要是路徑後面加上/var/data/elasticsearch/nodes，要不然無法加入叢集
path.data: /var/data/elasticsearch/nodes
path.logs: /var/log/elasticsearch
network.host: 10.90.15.44
http.port: 9200
transport.tcp.port: 9300
http.cors.enabled: true
http.cors.allow-origin: "*"
xpack.security.enabled: false
# 注意：位址的話可以配置内網IP位址
discovery.seed_hosts: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
cluster.initial_master_nodes: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
           

三台機器都啟動：

bin/elasticsearch -d
           

檢視叢集狀态：

浏覽器通路：http://10.90.15.45:9200/_cluster/health?pretty

{
  "cluster_name" : "es-cluster-test",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 3,
  "number_of_data_nodes" : 3,
  "active_primary_shards" : 0,
  "active_shards" : 0,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}
           

安裝Kibana

wget http://mirrors.huaweicloud.com/kibana/7.3.1/kibana-7.3.1-linux-x86_64.tar.gz
tar -zxvf kibana-7.3.1-linux-x86_64.tar.gz
cd kibana-7.3.1-linux-x86_64
vi config/kibana.yml
server.host: "10.90.15.44"
elasticsearch.hosts: ["http://10.90.15.45:9200", "http://10.90.15.44:9200", "http://10.90.15.43:9200"]
           

安裝Logstash

下載下傳：

wget http://mirrors.huaweicloud.com/logstash/7.3.1/logstash-7.3.1.tar.gz
tar -zvxf logstash-7.3.1.tar.gz
cd logstash-7.3.1
bin/logstash -e 'input{stdin{}}output{stdout{codec=>rubydebug}}'
{
    "@version" => "1",
    "host" => "edi-bis",
    "message" => "Hello,World",
    "@timestamp" => 2019-09-04T01:00:27.441Z
}